SUSE-SU-2022:2752-1 Security update for python-codecov

This update for python-codecov fixes the following issues: - CVE-2019-10800: Fixed sanitization of gcov arguments before being being provided to the popen method bsc1201494...

Workspace error 2306 happen when ICA file located in path which contains Chinese characters

Workspace error 2306 happen when ICA file located in path which contains Chinese character. Error message "Could not find the file named "C:??\.ica. Please check your installation , or contact your administrator."...

CWA Android : Citrix Workspace could not verify server or email address, Error code 437

CWA Android : Getting an error "Citrix workspace app could not verify the specified server or email address error code 437". when trying to logon to Workspace app for second time it shows this error...

OSV-2022-594 Container-overflow in STOFFStarMathToMMLConverterInternal::Parser::convert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49164 Crash type: Container-overflow READ 1 Crash state: STOFFStarMathToMMLConverterInternal::Parser::convert STOFFStarMathToMMLConverterInternal::Parser::parse STOFFStarMathToMMLConverter::convertStarMath...

CVE-2021-33656

When setting font with malicous data by ioctl cmd PIOFONT,kernel will write memory out of bounds...

SUSE-SU-2022:2405-2 Security update for p11-kit

This update for p11-kit fixes the following issues: - CVE-2020-29362: Fixed a 4 byte overread in p11rpcbuffergetbytearray which could lead to crashes bsc1180065...

ASB-A-231275476

In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

MAL-2022-5449 Malicious code in prepaid-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c68d977d75c5f9cd78d29e0aed942e0027de8b85b841b415f2aa34cbb91bd442 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-442 Malicious code in @msmg/vue-uid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 553b2404d6773b7d0f3548c2b1a5dd2dac7349a45d2cf9e3b6e1ec8a770a112a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2869 Malicious code in ethers-js-snap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fed39a2c0c5817dd6ae76956a74c435c13481436cac3eb9d117857ad9be21af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Information Disclosure Via Header Leak

mechanize is vulnerable to information disclosure. Remote unauthenticated attackers are able to gain access to the authorization header by redirecting a victim to a different port on the same site...

Failed to install VDA due to "Installation of the Citrix AppExperience failed with error code 1612"

Failed to install VDA due to "Installation of the Citrix AppExperience failed with error code 1612" MSI path: C:\WINDOWS\TEMP\Ctx-5CC1B7DD-10C1-4B5B-A4B3-EA564BA32118\Extract\Image-Full\x64\Virtual Desktop Components\WS\IcaAppExpx64.msi...

GHSA-4VR7-M8P8-434H MediaWiki Cross-site Scripting (XSS) vulnerability

In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, XSS related to jQuery can occur. The attacker creates a message with javascript:payload xss and turns it into a jQuery object with mw.message.parse. The expected result is that the jQuery object does not contain an tag or it does...

GHSA-22JM-4HXW-35JF OpenStack Nova can leak consoleauth token into log files

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is...

GHSA-C33M-22CR-J9X4 Designate does not enforce the DNS protocol limit concerning record set sizes

Designate does not enforce the DNS protocol limit concerning record set sizes...

Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS12 certificate...

cnlh nps vulnerable to file overwrite by local user

lib/install/install.go in cnlh nps prior to 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user...

GHSA-C5WC-V287-82PC HashiCorp Vault improper configuration of multi factor authentication

HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3...

GHSA-5CVH-XQHR-5G87 phpBB vulnerability related to use of "forum id" in circumstances related to a "global announcement."

Unspecified vulnerability in posting.php in phpBB before 3.0.5 has unknown impact and attack vectors related to the use of a "forum id" in circumstances related to a "global announcement."...

GHSA-G5FX-CCWV-5C4F Caucho Quercus, as distributed in Resin, overwrites entries in SERVER superglobal array on basis of POST parameters

Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors...